fix(Angular): do not auto bootstrap if the currentScript has been clobbered

Author: petebacondarwin

src/Angular.js

@@ -1453,6 +1453,11 @@ function allowAutoBootstrap(document) {
     return true;
   }
 
+  // If the `currentScript` property has been clobbered just return false, since this indicates a probable attack
+  if (!(script instanceof window.HTMLScriptElement || script instanceof window.SVGScriptElement)) {
+    return false;
+  }
+
   var srcs = [script.getAttribute('src'), script.getAttribute('href'), script.getAttribute('xlink:href')];
 
   return srcs.every(function(src) {

test/AngularSpec.js

@@ -1773,6 +1773,13 @@ describe('angular', function() {
           expect(allowAutoBootstrap(createFakeDoc({src: 'resource://something', href: 'http://something', 'xlink:href': 'http://something'}))).toBe(false);
         });
 
+        it('should not bootstrap if the currentScript property has been clobbered', function() {
+
+          var img = document.createElement('img');
+          img.setAttribute('src', '');
+          expect(allowAutoBootstrap(createFakeDoc({}, 'http:', img))).toBe(false);
+        });
+
         it('should not bootstrap if bootstrapping is disabled', function() {
           isAutoBootstrapAllowed = false;
           angularInit(jqLite('<div ng-app></div>')[0], bootstrapSpy);